@ftisindia/create-app 0.1.3 → 0.1.4

package/template/src/modules/invitations/application/services/invitations.service.ts

@@ -5,7 +5,7 @@ import {
   Injectable,
   NotFoundException,
   UnauthorizedException,
-} from "@nestjs/common";
+} from '@nestjs/common';
 import {
   AuthProvider,
   InvitationStatus,
@@ -13,18 +13,24 @@ import {
   MembershipStatus,
   Prisma,
   User,
-} from "@prisma/client";
-import { isEmail } from "class-validator";
-import { createHash, randomBytes } from "crypto";
-import { PrismaService } from "../../../../database/prisma/prisma.service";
-import { RbacCacheService } from "../../../access-control/application/services/rbac-cache.service";
-import { PasswordService } from "../../../auth/application/services/password.service";
-import { AuthenticatedUser } from "../../../auth/types/authenticated-user";
-import { MembershipsService } from "../../../memberships/application/services/memberships.service";
-import { RequestContextService } from "../../../request-context/application/services/request-context.service";
-import { AcceptInvitationDto } from "../../dto/accept-invitation.dto";
-import { CreateInvitationDto } from "../../dto/create-invitation.dto";
-import { InvitationTokenDto } from "../../dto/invitation-token.dto";
+} from '@prisma/client';
+import { isEmail } from 'class-validator';
+import { createHash, randomBytes } from 'crypto';
+import {
+  PaginationQueryDto,
+  resolvePageLimit,
+  toPage,
+} from '../../../../common/dto/pagination-query.dto';
+import { PrismaService } from '../../../../database/prisma/prisma.service';
+import { assertRoleWithinActorPermissions } from '../../../access-control/application/role-permission-policy';
+import { RbacCacheService } from '../../../access-control/application/services/rbac-cache.service';
+import { PasswordService } from '../../../auth/application/services/password.service';
+import { AuthenticatedUser } from '../../../auth/types/authenticated-user';
+import { MembershipsService } from '../../../memberships/application/services/memberships.service';
+import { RequestContextService } from '../../../request-context/application/services/request-context.service';
+import { AcceptInvitationDto } from '../../dto/accept-invitation.dto';
+import { CreateInvitationDto } from '../../dto/create-invitation.dto';
+import { InvitationTokenDto } from '../../dto/invitation-token.dto';
 
 const DEFAULT_INVITATION_EXPIRY_DAYS = 7;
 const mobileTargetPattern = /^\+?[1-9]\d{6,14}$/;
@@ -90,41 +96,22 @@ export class InvitationsService {
     private readonly requestContext: RequestContextService,
   ) {}
 
-  async createInvitation(
-    currentUser: AuthenticatedUser,
-    orgId: string,
-    dto: CreateInvitationDto,
-  ) {
+  async createInvitation(currentUser: AuthenticatedUser, orgId: string, dto: CreateInvitationDto) {
     this.requestContext.assertOrgScope(orgId);
 
-    const normalizedTargetValue = normalizeTarget(
-      dto.targetType,
-      dto.targetValue,
-    );
+    const normalizedTargetValue = normalizeTarget(dto.targetType, dto.targetValue);
     const targetValue = dto.targetValue.trim();
     const inviteToken = createInvitationToken();
     const tokenHash = hashInvitationToken(inviteToken);
-    const expiresAt = addDays(
-      new Date(),
-      dto.expiresInDays ?? DEFAULT_INVITATION_EXPIRY_DAYS,
-    );
+    const expiresAt = addDays(new Date(), dto.expiresInDays ?? DEFAULT_INVITATION_EXPIRY_DAYS);
 
     let invitation: InvitationDetail;
     try {
       invitation = await this.prisma.$transaction(async (tx) => {
-        await this.membershipsService.assertActiveMembership(
-          currentUser.id,
-          orgId,
-          tx,
-        );
+        await this.membershipsService.assertActiveMembership(currentUser.id, orgId, tx);
         await this.lockOrganisation(tx, orgId);
-        await this.assertRoleBelongsToOrg(tx, orgId, dto.roleId);
-        await this.assertNoPendingInvitation(
-          tx,
-          orgId,
-          dto.targetType,
-          normalizedTargetValue,
-        );
+        await this.assertRoleWithinInviterPermissions(tx, currentUser, orgId, dto.roleId);
+        await this.assertNoPendingInvitation(tx, orgId, dto.targetType, normalizedTargetValue);
         await this.assertTargetIsNotExistingMember(
           tx,
           orgId,
@@ -149,7 +136,7 @@ export class InvitationsService {
         await this.writeAudit(tx, {
           orgId,
           actorUserId: currentUser.id,
-          action: "invitation.create",
+          action: 'invitation.create',
           targetId: created.id,
           metadata: {
             targetType: created.targetType,
@@ -163,9 +150,7 @@ export class InvitationsService {
       });
     } catch (error) {
       if (isPrismaUniqueError(error)) {
-        throw new ConflictException(
-          "A pending invitation already exists for this target.",
-        );
+        throw new ConflictException('A pending invitation already exists for this target.');
       }
 
       throw error;
@@ -177,38 +162,34 @@ export class InvitationsService {
     };
   }
 
-  async listInvitations(currentUser: AuthenticatedUser, orgId: string) {
+  async listInvitations(currentUser: AuthenticatedUser, orgId: string, query: PaginationQueryDto) {
     this.requestContext.assertOrgScope(orgId);
     await this.membershipsService.assertActiveMembership(currentUser.id, orgId);
+    const limit = resolvePageLimit(query.limit);
 
     const invitations = await this.prisma.invitation.findMany({
       where: { orgId },
       include: invitationDetailInclude,
-      orderBy: { createdAt: "desc" },
+      orderBy: { createdAt: 'desc' },
+      take: limit + 1,
+      ...(query.cursor
+        ? {
+            cursor: { id: query.cursor },
+            skip: 1,
+          }
+        : {}),
     });
 
-    return invitations.map(serializeInvitation);
+    return toPage(invitations.map(serializeInvitation), limit);
   }
 
-  async revokeInvitation(
-    currentUser: AuthenticatedUser,
-    orgId: string,
-    invitationId: string,
-  ) {
+  async revokeInvitation(currentUser: AuthenticatedUser, orgId: string, invitationId: string) {
     this.requestContext.assertOrgScope(orgId);
 
     return this.prisma.$transaction(async (tx) => {
-      await this.membershipsService.assertActiveMembership(
-        currentUser.id,
-        orgId,
-        tx,
-      );
+      await this.membershipsService.assertActiveMembership(currentUser.id, orgId, tx);
 
-      const invitation = await this.findInvitationInOrgForUpdate(
-        tx,
-        orgId,
-        invitationId,
-      );
+      const invitation = await this.findInvitationInOrgForUpdate(tx, orgId, invitationId);
       this.assertPendingInvitation(invitation);
       this.assertInvitationNotExpiredInTransaction(invitation);
 
@@ -236,7 +217,7 @@ export class InvitationsService {
       await this.writeAudit(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "invitation.revoke",
+        action: 'invitation.revoke',
         targetId: invitation.id,
         metadata: {
           targetType: invitation.targetType,
@@ -248,30 +229,18 @@ export class InvitationsService {
     });
   }
 
-  async resendInvitation(
-    currentUser: AuthenticatedUser,
-    orgId: string,
-    invitationId: string,
-  ) {
+  async resendInvitation(currentUser: AuthenticatedUser, orgId: string, invitationId: string) {
     this.requestContext.assertOrgScope(orgId);
 
     const inviteToken = createInvitationToken();
     const tokenHash = hashInvitationToken(inviteToken);
 
     const invitation = await this.prisma.$transaction(async (tx) => {
-      await this.membershipsService.assertActiveMembership(
-        currentUser.id,
-        orgId,
-        tx,
-      );
+      await this.membershipsService.assertActiveMembership(currentUser.id, orgId, tx);
 
-      const existing = await this.findInvitationInOrgForUpdate(
-        tx,
-        orgId,
-        invitationId,
-      );
+      const existing = await this.findInvitationInOrgForUpdate(tx, orgId, invitationId);
       this.assertResendableInvitation(existing);
-      await this.assertRoleBelongsToOrg(tx, orgId, existing.roleId);
+      await this.assertRoleWithinInviterPermissions(tx, currentUser, orgId, existing.roleId);
       await this.assertTargetIsNotExistingMember(
         tx,
         orgId,
@@ -305,7 +274,7 @@ export class InvitationsService {
       await this.writeAudit(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "invitation.resend",
+        action: 'invitation.resend',
         targetId: existing.id,
         metadata: {
           targetType: existing.targetType,
@@ -329,24 +298,13 @@ export class InvitationsService {
     await this.assertInvitationNotExpired(invitation);
 
     const result = await this.prisma.$transaction(async (tx) => {
-      const pendingInvitation = await this.findInvitationByTokenForUpdate(
-        tx,
-        tokenHash,
-      );
+      const pendingInvitation = await this.findInvitationByTokenForUpdate(tx, tokenHash);
       this.assertPendingInvitation(pendingInvitation);
       this.assertInvitationNotExpiredInTransaction(pendingInvitation);
-      await this.assertRoleBelongsToOrg(
-        tx,
-        pendingInvitation.orgId,
-        pendingInvitation.roleId,
-      );
+      await this.assertRoleBelongsToOrg(tx, pendingInvitation.orgId, pendingInvitation.roleId);
 
       const user = await this.resolveTargetUser(tx, pendingInvitation, dto);
-      await this.assertMembershipCanBeCreated(
-        tx,
-        pendingInvitation.orgId,
-        user.id,
-      );
+      await this.assertMembershipCanBeCreated(tx, pendingInvitation.orgId, user.id);
 
       const membership = await tx.membership.create({
         data: {
@@ -385,7 +343,7 @@ export class InvitationsService {
       await this.writeAudit(tx, {
         orgId: pendingInvitation.orgId,
         actorUserId: user.id,
-        action: "invitation.accept",
+        action: 'invitation.accept',
         targetId: pendingInvitation.id,
         metadata: {
           targetType: pendingInvitation.targetType,
@@ -397,8 +355,8 @@ export class InvitationsService {
       await this.writeAudit(tx, {
         orgId: pendingInvitation.orgId,
         actorUserId: user.id,
-        action: "membership.created",
-        targetType: "Membership",
+        action: 'membership.created',
+        targetType: 'Membership',
         targetId: membership.id,
         metadata: {
           invitedByUserId: pendingInvitation.invitedByUserId,
@@ -419,10 +377,7 @@ export class InvitationsService {
       };
     });
 
-    this.rbacCache.invalidate(
-      result.rbacInvalidation.userId,
-      result.rbacInvalidation.orgId,
-    );
+    this.rbacCache.invalidate(result.rbacInvalidation.userId, result.rbacInvalidation.orgId);
 
     const { rbacInvalidation: _rbacInvalidation, ...response } = result;
     return response;
@@ -434,10 +389,7 @@ export class InvitationsService {
     await this.assertInvitationNotExpired(invitation);
 
     return this.prisma.$transaction(async (tx) => {
-      const pendingInvitation = await this.findInvitationByTokenForUpdate(
-        tx,
-        tokenHash,
-      );
+      const pendingInvitation = await this.findInvitationByTokenForUpdate(tx, tokenHash);
       this.assertPendingInvitation(pendingInvitation);
       this.assertInvitationNotExpiredInTransaction(pendingInvitation);
 
@@ -463,7 +415,7 @@ export class InvitationsService {
 
       await this.writeAudit(tx, {
         orgId: pendingInvitation.orgId,
-        action: "invitation.decline",
+        action: 'invitation.decline',
         targetId: pendingInvitation.id,
         metadata: {
           targetType: pendingInvitation.targetType,
@@ -489,10 +441,7 @@ export class InvitationsService {
     return invitation;
   }
 
-  private async findInvitationByTokenForUpdate(
-    tx: Prisma.TransactionClient,
-    tokenHash: string,
-  ) {
+  private async findInvitationByTokenForUpdate(tx: Prisma.TransactionClient, tokenHash: string) {
     const rows = await tx.$queryRaw<Array<{ id: string }>>`
       SELECT "id"
       FROM "Invitation"
@@ -516,11 +465,7 @@ export class InvitationsService {
     return invitation;
   }
 
-  private async findInvitationInOrg(
-    client: PrismaClient,
-    orgId: string,
-    invitationId: string,
-  ) {
+  private async findInvitationInOrg(client: PrismaClient, orgId: string, invitationId: string) {
     const invitation = await client.invitation.findFirst({
       where: {
         id: invitationId,
@@ -530,9 +475,7 @@ export class InvitationsService {
     });
 
     if (!invitation) {
-      throw new NotFoundException(
-        "Invitation was not found in this organisation.",
-      );
+      throw new NotFoundException('Invitation was not found in this organisation.');
     }
 
     return invitation;
@@ -552,9 +495,7 @@ export class InvitationsService {
     `;
 
     if (rows.length === 0) {
-      throw new NotFoundException(
-        "Invitation was not found in this organisation.",
-      );
+      throw new NotFoundException('Invitation was not found in this organisation.');
     }
 
     return tx.invitation.findUniqueOrThrow({
@@ -572,8 +513,29 @@ export class InvitationsService {
     `;
   }
 
-  private async assertRoleBelongsToOrg(
+  private async assertRoleBelongsToOrg(client: PrismaClient, orgId: string, roleId: string) {
+    const role = await client.role.findUnique({
+      where: {
+        id_orgId: {
+          id: roleId,
+          orgId,
+        },
+      },
+      select: { id: true },
+    });
+
+    if (!role) {
+      throw new NotFoundException('Role was not found in this organisation.');
+    }
+  }
+
+  // Used on the invite-create and resend paths (where there is an authenticated
+  // inviter): the role must exist in the org AND its permissions must be within
+  // the inviter's own, so a member cannot invite someone into a more privileged
+  // role than they hold. The public accept path keeps assertRoleBelongsToOrg.
+  private async assertRoleWithinInviterPermissions(
     client: PrismaClient,
+    currentUser: AuthenticatedUser,
     orgId: string,
     roleId: string,
   ) {
@@ -584,12 +546,23 @@ export class InvitationsService {
           orgId,
         },
       },
-      select: { id: true },
+      select: {
+        permissions: {
+          select: { permission: { select: { key: true } } },
+        },
+      },
     });
 
     if (!role) {
-      throw new NotFoundException("Role was not found in this organisation.");
+      throw new NotFoundException('Role was not found in this organisation.');
     }
+
+    const actorContext = await this.rbacCache.getContext(currentUser.id, orgId);
+    assertRoleWithinActorPermissions({
+      actorIsOwner: actorContext.isOwner,
+      actorPermissionKeys: actorContext.permissionKeys,
+      rolePermissionKeys: role.permissions.map((rolePermission) => rolePermission.permission.key),
+    });
   }
 
   private async assertNoPendingInvitation(
@@ -609,34 +582,26 @@ export class InvitationsService {
     });
 
     if (existing) {
-      throw new ConflictException(
-        "A pending invitation already exists for this target.",
-      );
+      throw new ConflictException('A pending invitation already exists for this target.');
     }
   }
 
-  private assertPendingInvitation(
-    invitation: Pick<InvitationDetail, "status">,
-  ) {
+  private assertPendingInvitation(invitation: Pick<InvitationDetail, 'status'>) {
     if (invitation.status === InvitationStatus.EXPIRED) {
-      throw new GoneException("Invitation has expired.");
+      throw new GoneException('Invitation has expired.');
     }
 
     if (invitation.status !== InvitationStatus.PENDING) {
-      throw new ConflictException("Invitation is no longer pending.");
+      throw new ConflictException('Invitation is no longer pending.');
     }
   }
 
-  private assertResendableInvitation(
-    invitation: Pick<InvitationDetail, "status">,
-  ) {
+  private assertResendableInvitation(invitation: Pick<InvitationDetail, 'status'>) {
     if (
       invitation.status !== InvitationStatus.PENDING &&
       invitation.status !== InvitationStatus.EXPIRED
     ) {
-      throw new ConflictException(
-        "Invitation cannot be resent after it has been completed.",
-      );
+      throw new ConflictException('Invitation cannot be resent after it has been completed.');
     }
   }
 
@@ -646,21 +611,19 @@ export class InvitationsService {
     }
 
     await this.markInvitationExpired(invitation);
-    throw new GoneException("Invitation has expired.");
+    throw new GoneException('Invitation has expired.');
   }
 
-  private assertInvitationNotExpiredInTransaction(
-    invitation: InvitationDetail,
-  ) {
+  private assertInvitationNotExpiredInTransaction(invitation: InvitationDetail) {
     if (invitation.status === InvitationStatus.EXPIRED) {
-      throw new GoneException("Invitation has expired.");
+      throw new GoneException('Invitation has expired.');
     }
 
     if (invitation.expiresAt > new Date()) {
       return;
     }
 
-    throw new GoneException("Invitation has expired.");
+    throw new GoneException('Invitation has expired.');
   }
 
   private async markInvitationExpired(invitation: InvitationDetail) {
@@ -668,9 +631,7 @@ export class InvitationsService {
       return;
     }
 
-    await this.prisma.$transaction((tx) =>
-      this.markInvitationExpiredInTransaction(tx, invitation),
-    );
+    await this.prisma.$transaction((tx) => this.markInvitationExpiredInTransaction(tx, invitation));
   }
 
   private async markInvitationExpiredInTransaction(
@@ -694,7 +655,7 @@ export class InvitationsService {
 
     await this.writeAudit(tx, {
       orgId: invitation.orgId,
-      action: "invitation.expired",
+      action: 'invitation.expired',
       targetId: invitation.id,
       metadata: {
         targetType: invitation.targetType,
@@ -726,7 +687,7 @@ export class InvitationsService {
 
     if (existing) {
       if (!existing.isActive) {
-        throw new ConflictException("The invited user is inactive.");
+        throw new ConflictException('The invited user is inactive.');
       }
 
       return existing;
@@ -734,7 +695,7 @@ export class InvitationsService {
 
     if (!dto.password) {
       throw new BadRequestException(
-        "Password is required when accepting an email invitation as a new user.",
+        'Password is required when accepting an email invitation as a new user.',
       );
     }
 
@@ -770,7 +731,7 @@ export class InvitationsService {
 
     if (existing) {
       if (!existing.isActive) {
-        throw new ConflictException("The invited user is inactive.");
+        throw new ConflictException('The invited user is inactive.');
       }
 
       return existing;
@@ -818,14 +779,10 @@ export class InvitationsService {
     }
 
     if (existing.status === MembershipStatus.REVOKED) {
-      throw new ConflictException(
-        "Revoked memberships cannot be reused through an invitation.",
-      );
+      throw new ConflictException('Revoked memberships cannot be reused through an invitation.');
     }
 
-    throw new ConflictException(
-      "User already has a membership in this organisation.",
-    );
+    throw new ConflictException('User already has a membership in this organisation.');
   }
 
   private async assertTargetIsNotExistingMember(
@@ -865,13 +822,11 @@ export class InvitationsService {
 
     if (membership.status === MembershipStatus.REVOKED) {
       throw new ConflictException(
-        "A revoked membership already exists for this invitation target.",
+        'A revoked membership already exists for this invitation target.',
       );
     }
 
-    throw new ConflictException(
-      "Invitation target already has a membership in this organisation.",
-    );
+    throw new ConflictException('Invitation target already has a membership in this organisation.');
   }
 
   private async writeAudit(
@@ -890,24 +845,25 @@ export class InvitationsService {
         orgId: data.orgId,
         actorUserId: data.actorUserId,
         action: data.action,
-        targetType: data.targetType ?? "Invitation",
+        targetType: data.targetType ?? 'Invitation',
         targetId: data.targetId,
         metadata: data.metadata,
+        ipAddress: this.requestContext.getIpAddress(),
+        userAgent: this.requestContext.getUserAgent(),
       },
     });
   }
 }
 
 function createInvitationToken() {
-  return randomBytes(32).toString("base64url");
+  return randomBytes(32).toString('base64url');
 }
 
 function hashInvitationToken(token: string) {
-  return createHash("sha256").update(token).digest("hex");
+  return createHash('sha256').update(token).digest('hex');
 }
 
-const deadTokenHash = () =>
-  hashInvitationToken(randomBytes(32).toString("base64url"));
+const deadTokenHash = () => hashInvitationToken(randomBytes(32).toString('base64url'));
 
 function addDays(date: Date, days: number) {
   const next = new Date(date);
@@ -919,18 +875,16 @@ function normalizeTarget(type: InvitationTargetType, value: string) {
   if (type === InvitationTargetType.EMAIL) {
     const email = value.trim().toLowerCase();
     if (!isEmail(email)) {
-      throw new BadRequestException("Invitation email must be valid.");
+      throw new BadRequestException('Invitation email must be valid.');
     }
     return email;
   }
 
-  const mobile = value.trim().replace(/[\s()-]/g, "");
-  const normalized = mobile.startsWith("00") ? `+${mobile.slice(2)}` : mobile;
+  const mobile = value.trim().replace(/[\s()-]/g, '');
+  const normalized = mobile.startsWith('00') ? `+${mobile.slice(2)}` : mobile;
 
   if (!mobileTargetPattern.test(normalized)) {
-    throw new BadRequestException(
-      "Invitation mobile number must be E.164-style.",
-    );
+    throw new BadRequestException('Invitation mobile number must be E.164-style.');
   }
 
   return normalized;
@@ -952,16 +906,13 @@ function toSafeUser(user: User) {
 }
 
 function invalidInvitationToken() {
-  return new UnauthorizedException("Invalid invitation token.");
+  return new UnauthorizedException('Invalid invitation token.');
 }
 
 function invitationStateChanged() {
-  return new ConflictException("Invitation is no longer pending.");
+  return new ConflictException('Invitation is no longer pending.');
 }
 
 function isPrismaUniqueError(error: unknown) {
-  return (
-    error instanceof Prisma.PrismaClientKnownRequestError &&
-    error.code === "P2002"
-  );
+  return error instanceof Prisma.PrismaClientKnownRequestError && error.code === 'P2002';
 }

package/template/src/modules/invitations/dto/accept-invitation.dto.ts

@@ -1,12 +1,11 @@
-import { ApiPropertyOptional } from "@nestjs/swagger";
-import { IsOptional, IsString, MaxLength, MinLength } from "class-validator";
-import { InvitationTokenDto } from "./invitation-token.dto";
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsOptional, IsString, MaxLength, MinLength } from 'class-validator';
+import { InvitationTokenDto } from './invitation-token.dto';
 
 export class AcceptInvitationDto extends InvitationTokenDto {
   @ApiPropertyOptional({
-    description:
-      "Required only when the invitation target is an email with no existing user.",
-    example: "dev-password-123",
+    description: 'Required only when the invitation target is an email with no existing user.',
+    example: 'dev-password-123',
     minLength: 8,
     maxLength: 128,
   })
@@ -16,7 +15,7 @@ export class AcceptInvitationDto extends InvitationTokenDto {
   @MaxLength(128)
   password?: string;
 
-  @ApiPropertyOptional({ example: "New Member", maxLength: 120 })
+  @ApiPropertyOptional({ example: 'New Member', maxLength: 120 })
   @IsOptional()
   @IsString()
   @MaxLength(120)